This Thursday, the European Commission opened an infringement procedure against Spain for the controversial traveler registry promoted by the Ministry of the Interior. Brussels considers that the rule violates European regulations on data protection in the criminal field, by forcing hotels, digital platforms and car rental companies to collect and send personal information of tourists to a state database that is then accessible to the Police. We tell you all the details.
What are we talking about? This is known as the Traveler Registry, regulated by Royal Decree 933/2021 and fully operational since the end of last year. The regulations obliges accommodations, travel agencies and vehicle rental companies to upload their clients’ data into the ‘ses.hospedajes’ application and transmit them to a centralized Government database.
As La Vanguardia points out, the objective declared by the Interior, which can be read in the preamble of the decree itself, is to reinforce the fight against terrorism and organized crime, activities in which, the ministry argues, accommodation and the use of vehicles have special logistical relevance.
What a reproach Brussels. The Commission points to three specific problems. First, it considers the categories of data collected and stored to be “excessive”, due to the variety of sets they cover, including payment and GPS data. Second, it maintains that access by police authorities “is not limited to specific and explicit purposes”, as required by directive 2016/680. And third, it describes as “disproportionate” that these data are kept for three years after the traveler’s stay.
Amount of data. One of the big discussions revolves around how much data there really is to deliver. The hotel sector has denounced that the rule requires up to 42 different fields, while the Government insists that only 13 are mandatory: name and surname, number and type of document, reference and date of the contract, arrival and departure dates, means of payment, telephone or email and the family relationship when a minor travels. The remaining data, according to the Executive, are not mandatory to complete.
The file. The procedure opens a period of two months for Spain to respond and correct the irregularities. If the answer is not convincing, the Commission can issue a reasoned opinion, a kind of official ultimatum. And if non-compliance persists, the last step would be to take the State before the Court of Justice of the EU.
The reaction of the sector. Hoteliers and travel agencies have been on the warpath for some time. The Spanish Confederation of Hotels and Tourist Accommodations (CEHAT) has questioned the legality of the collection and transmission of data because it conflicts with European regulations on free movement and data protection.
After learning about the file, the agency associations Fetave and Unav have asked the Government for the “urgent suspension” of Royal Decree 933/2021 and an immediate meeting with the Interior, considering that the Executive “cannot act as if nothing had happened” when Brussels has formally questioned the compatibility of the rule with EU Law.
And now what. Spain has two months to make a move. Interior can defend the rule, modify it or suspend it while the procedure is resolved. However, pressure is growing, on the one hand from the tourism sector, which has been demanding changes even before the rule came into force; on the other, that of the European Commission, which had already warned of the clash of that decision with data protection regulations. Now that warning is in writing, so we will have to wait and see how things progress.
Cover Image | François Genon y Square
In | The European Union has been flooding the countryside with billions of euros for half a century. It has been of no use
